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This module should be read in conjunction with the Introduction and with the 
Glossary, which contains an explanation of abbreviations and other terms used 
in this Manual. If reading on-line, click on blue underlined headings to activate 
hyperlinks to the relevant module. 


Purpose 


To provide guidance to Als on the management of risks associated with 
credit card business 


Classification 


A non-statutory guideline issued by the MA as a guidance note 


Previous guidelines superseded 


Guideline 3.6 "Referees in Applications for Credit Cards or Loans" dated 
23.01.96; Circular on “Credit Card Lending” dated 21.06.01; and “Best 
Practices for Credit Card Operations” (Annex to Circular on “Bankruptcy 
and Consumer Credit Lending” dated 22.02.02) 


Application 


To all Als that engage in credit card business directly or through their 
subsidiaries or affiliated companies controlled by them 


Structure 
1. Background and scope 
1.1 Introduction 
1.2 Basic features of credit cards 
1.3 Types of credit cards 
1.4 Sources of income for credit cards 
1.5 Areas covered in the Code of Banking Practice 
1.6 Application to other unsecured consumer finance 
2. Major risks in credit card business 
2.1 Credit risk 
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2.2 Operational risk 
2.3 Liquidity risk 
2.4 Legal and reputation risks 


3. Board and senior management oversight 
3.1 Business strategies 
3.2 Risk management controls 
4. Account solicitation and approval process 
4.1 Marketing programmes 
4.2 Application information 
4.3 Verification of documentation and credit checking 
4.4 — Underwriting criteria 
4.5 Controls over approval process 
4.6 Credit limit assignment 
4.7 Card issuing controls 
4.8 Approval of new merchants 
5: Account and portfolio management 
5.1 Cardholder account management 
5.2 Merchant account management 
5.3 Portfolio quality and analysis 
5.4 Fraud control 
5.5 Delinquency management 
5.6 Restructuring and debt relief plans 
6. Provisioning and charge-oft 
6.1 General 
6.2 Overdue period 
6.3 Loan classification and provisioning 
6.4 Charge-oft 


Annex A: scoring systems 
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1. 


Background and scope 


1.1 Introduction 


1.1.1 


This module is aimed at providing general guidance to Als 
on the risks associated with credit card business, and the 
systems of control expected of them in managing such 
business. It also sets out the best practices that they 
should aim to achieve’. 


Experience has shown that the quality of Als credit card 
portfolios mirrors the economic environment in which they 
operate. Very often, there is a strong correlation between 
an economic downturn and deterioration in the quality of 
such portfolios. The deterioration may become even more 
serious if Als have relaxed their credit underwriting criteria 
and risk management standards as a result of intense 
competition in the market. It is therefore important for Als 
to maintain prudent policies and practices for managing 
the risks of their credit card business which are relevant to 
the market environment that they operate in. 


To facilitate a better understanding of the risks involved, 
the basic features of credit cards and their associated 
operations are highlighted in subsections 1.2 to 1.4 below. 


1.2 Basic features of credit cards 


1.2.1 


1.2.2 


The term “credit card” generally refers to a plastic card? 
assigned to a cardholder with a credit limit that can be 
used to purchase goods and services on credit or obtain 
cash advances. 


Credit cards allow cardholders to pay for purchases made 
over a period of time, and to carry a balance from one 


If Als have adopted some practices that may not fully align with those recommended in this 
module, they are expected to provide justifications for the approach taken and be able to 
demonstrate that adequate risk assessment has been undertaken and the risk mitigating 
measures in place are sufficiently robust to cater for these practices. 


? Some Als may assign a virtual card number that is different from that on the plastic card t 
enable the cardholder to purchase goods and services on the internet. The credit limit of the 
virtual card is usually very low. 
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1.2.3 


1.2.4 
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billing cycle to the next. Credit card purchases normally 
become payable after a free credit period (See para. 1.4.2 
below) during which no interest or finance charge is 
imposed. Interest is charged on the unpaid balance after 
the payment is due. Cardholders may pay the entire 
amount due and save on the interest that would otherwise 
be charged. Alternatively, they have the option of paying 
any amount, as long as it is higher than the minimum 
amount due, and carrying forward the balance. 


A credit card scheme typically involves the following 
parties: 


° Cardholders - persons who are authorized to use 
credit cards for the payment of goods and services; 

° Card issuers - institutions which issue credit cards; 

° Merchants - firms which agree to accept credit 


cards for payment of goods and services; 


e Merchant acquirers - institutions which enter into 
agreements with merchants to process their credit 
card transactions; and 


° Credit card associations - organisations that 
license card issuers to issue credit cards under 
their trademark, e.g. Visa and MasterCard, and 
provide settlement services for their members (i.e. 
card issuers and merchant acquirers). 


The relationships between these various parties are 
illustrated in the following diagram: 
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1.2.5 


1.2.6 


1.2.7 


1.2.8 


Credit card schemes normally operate at an international 
level, meaning that cardholders belonging to card issuers 
in one country can make purchases at the place of 
business of merchants signed up by merchant acquirers in 
another country. 


Credit cards include charge cards (also called “travel and 
entertainment” cards), which are proprietary brands (e.g. 
Diners Club) that are not affiliated with any credit card 
association or any of the other brands, and the same 
organisation acts as the card issuer and the merchant 
acquirer. 


Charge cards have similar features as credit cards, except 
that they do not normally have pre-set spending limits. 
Another difference is that the balance on a charge card 
account is payable in full when the statement is received 
and cannot be rolled over from one billing cycle to the next. 
In spite of this, revolving credit is available on some plans 
to enable cardholders to leave a pre-set balance unpaid. 


The focus of this module is on the operations, risks and 
controls associated with credit card schemes of which Als 
(or their subsidiaries or affiliated companies under their 
control) are the card issuer or the merchant acquirer. As 
such, relevant requirements of this module also apply to 
charge card schemes operated by Als directly or through 
their subsidiaries / affiliates. 


Types of credit cards 


1.3.1 


1.3.2 


Credit cards can be broadly categorised into two types: 
general purpose cards and private label cards. The former 
are issued under the trademark of credit card associations 
and accepted by many merchants while the latter are only 
accepted by specific retailers (e.g. a department store). 


Most of the card issuing Als in Hong Kong offer general 
purpose credit cards. These cards are normally 
categorised by Als as platinum, gold or classic to 
differentiate the services offered on each card and the 
income eligibility criteria. Als may, at the request of a 
cardholder, issue a supplementary card to another 
individual who is usually an immediate family member of 
the cardholder. 
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1.3.3 It is quite common for Als to partner with business 
corporations or non-profit making organisations (e.g. 
charitable or professional bodies) to issue co-branded 
cards or affinity cards. 


1.3.4 Als may also issue corporate credit cards to the 
employees of their corporate customers. Generally the 
employees use these cards for travel and entertainment 
expenses incurred in the course of their work. 


1.3.5 The types of credit cards mentioned above are not 
exhaustive. Als may, from time to time, introduce new 
credit card products to satisfy customer needs and cater 
for changes in market conditions. 


1.4 Sources of income for credit cards 


1.4.1 Credit card income is generated from different types of 
fees and charges. While such fees and charges may vary 
among card issuers or merchant acquirers, they generally 
include the following: 


Card issuers 


e Annual fee — this is payable at the start of the 
membership year. However, it is not uncommon for 
card issuers to waive the annual fee as an incentive to 
increase cardholders’ loyalty; 


e Interest charge on outstanding balance — this 
constitutes the bulk of the earnings from credit cards. 


The methodology of interest calculation differs among 
Als. As an example, the card issuer may charge the 
cardholder interest on the balance carried forward 
from the payment due date. The period of time 
between the transaction date and the payment due 
date (around three weeks from the billing date) for 
credit card purchases is interest free, provided that 
the billed amount is repaid on or before the due date. 
Otherwise, interest on the unpaid balance will be 
charged from the transaction date. The cardholder is 
liable to pay a minimum amount due, which is set at a 
percentage of the billed amount. 


e Fees and charges on cash advances — cardholders 
are allowed to withdraw cash from designated ATMs 


or over the counter of the card issuer or its affiliated 
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companies, using the credit card. A handling fee is 
imposed when the cash is withdrawn. Interest is also 
charged once the cash advance facility is utilised. 


e Foreign exchange differential — most of the credit 
cards can be used overseas. When cardholders 


spend in foreign currencies and settle the dues in the 
local currency, card issuers profit from the differential 
between the bid and ask prices of the foreign 
currencies. 


e Interchange fee — when card issuers reimburse 
merchant acquirers on credit card transactions, an 
interchange fee is charged to cover various costs 
relating to transaction processing and authorization, 
fraud and fraud prevention, funding for the interest free 
period, and the payment guarantee. 


e Other fees and charges — card issuers may also 
impose on cardholders other fees and finance 
charges for paying late or for exceeding the credit 
limit. 

Merchant acquirers 


o Fees and charges on merchants — merchant 
acquirers may levy on merchants processing, 


servicing or setup fees (e.g. for e-commerce 
merchants). The amount and types of fees charged 
vary among merchant acquirers, and can be 
negotiated with the merchants in the light of their 
business relationships. lt is common for a discount 
rate to be imposed on the value of credit card 
transactions presented by merchants. 


1.5 Areas covered in the Code of Banking Practice 


1.5.1 The Code of Banking Practice (“the Code”), which was 
issued jointly by the Hong Kong Association of Banks and 
the DTC Association, sets out the minimum standards that 
Als are expected to observe when dealing with their 
personal customers. Reference should be made to 
Chapters 1, 3 and 5 of the Code which covers the following 
areas that are pertinent to credit card business: 
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e the issue of cards; 


e the disclosure of terms and conditions (including fees 
and charges and annualised percentage rates); 


e the right of set-off; 


e the collection, use and holding of customer 
information (including personal referees); 


e the security of cards / personal identification numbers 
(“PINs”); 


e transaction records; 


e unauthorized transactions / lost cards / liability for 
loss; 


e handling customer complaints (see also IC-4 
“Complaint Handling Procedures” ); and 


e the use of debt collection agencies. 


1.5.2 Als should ensure that all relevant provisions of the Code 
are complied with in their conduct of credit card business 
SO as to promote good banking practices, avoid customer 
disputes and foster business relationships. 


1.6 Application to other unsecured consumer finance 


1.6.1 Other unsecured consumer finance refers to short or 
medium term lending extended to individuals to finance 
their personal expenditure (i.e. not for business or home 
purchase) on an unsecured basis. Such lending includes 
personal loans, tax loans, and overdrafts. 


1.6.2 Although credit card business has its own distinct features, 
it shares some common characteristics (e.g. in relation to 
credit and legal risks) with other types of unsecured 
consumer finance. Hence, in managing such credit 
products, Als should, where applicable, have regard to the 
general lending and risk management principles set out in 
sections 3 to 6 below. 
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2. Major risks in credit card business 


2.1 Credit risk 


2.1.1 Credit risk poses a significant risk to Als involved in credit 
card business. A card issuing Al has an exposure to a 
cardholder when the Al reimburses a merchant acquirer” 
for a transaction on behalf of the cardholder or when the 
cardholder obtains cash advances from his credit card 
account. Such an exposure will remain if the cardholder 
does not repay the entire amount of the outstanding 
balance by the due date. As credit card lending is 
unsecured, the source of repayment depends primarily 
upon the cardholder s creditworthiness and repayment 
capacity. 


2.1.2 Itis not uncommon for customers to hold multiple credit 
cards issued by the same or different Als. Availability of 
sufficient information is important for Als to assess the 
overall indebtedness and creditworthiness of their credit 
card applicants. In this regard, the establishment of a 
credit reference agency (see IC-6 “The Sharing and Use of 
Consumer Credit Data through a Credit Reference 
Agency” for more details) in Hong Kong to provide 
consumer credit reference service has enhanced Als 
ability to make more informed credit decisions (see also 
paras. 3.1.2 and 4.3.6 below). 


2.1.3 Credit risk may be increased considerably if Als adopt 
aggressive strategies for expanding their credit card 
business due to competitive pressures, without managing 
the associated risks properly. These may include: 


e relaxing the underwriting standards for approving 
credit card applications, including those solicited 
under “pre-approved” programmes; 


e adopting a relaxed attitude in accepting alternative 
income proof for assessing the creditworthiness of 
applicants; 


° This may be a local or an overseas (in the case of overseas spending) financial institution. 
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e offering multiple credit cards to existing cardholders 
or an excessive increase in their credit card limits 
without adequate assessment of their overall 
repayment capacity; and 


e delaying collection actions (e.g. tolerating limit 
excesses) on customers with repayment problem. 


Such practices could mask portfolio quality, increase the 
risk profile of cardholders quickly and result in rapid and 
Significant portfolio deterioration, especially when 
economic conditions worsen. 


2.1.4 As merchant acquirers, Als incur credit risk when 
merchants fail to reimburse them for chargebacks’. 


2.2 Operational risk 


2.2.1 Credit card operations are highly automated and involve 
large volumes of customer and transactional data. These 
characteristics reflect the need for strong operational and 
security controls. 


2.2.2 Both card issuing and merchant acquiring Als are exposed 
to operational risk from various sources, including data 
processing and security issues, outsourcing arrangements 
and fraudulent transactions. 


Data processing and security issues 


2.2.3 The highly automated processing environment for credit 
cards is susceptible to data processing and security risks. 
It is therefore important for Als to put in place relevant 
policies and procedures to control these risks. In 
particular, they should focus on having adequate controls 
and procedures to protect data integrity and security of 
customer information (including data retention and 
confidentiality) as well as appropriate back-up and 
disaster recovery plans and regular testing of such 
arrangements to guard against system failure and 
unexpected disruptions. Relevant guidance is contained in 
TM-G-1 “General Principles for Technology Risk 
Management” and IM-G-2 “Business Continuity Planning”. 


* Chargebacks are reversed transactions, usually caused by customer disputes such as the 
return of faulty goods by cardholders and non-delivery of goods and services by merchants, 
processing errors or fraud. 
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Moreover, Als should regularly review their operational 
Capacity to ensure that it is adequate to cope with any 
targeted growth in business volume. 


Outsourcing arrangements 


2.2.4 As the use of third party service providers” to handle all or 
part of the credit card processing functions has become 
increasingly common, Als should be fully aware of the nsks 
of improper management of outsourced activities. If the 
systems and controls of the service providers turn out to be 
defective, this could lead to a decline in operational or 
servicing standards for the outsourced functions or even 
the leakage and misuse of credit card data processed or 
stored in their systems. 


2.2.0 Itis essential for Als to follow the general guidance given in 
SA-2 “Outsourcing”. Apart from consulting the HKMA on 
the outsourcing arrangements, Als should be satisfied with 
the control environment of the service providers 
concerned, including the security controls over the integrity 
and confidentiality of customer information maintained in 
the outsourced systems, and ensure that they comply with 
the security standards and requirements of the credit card 
associations. This should be ascertained by Als through 
regular review and evaluation that the relevant controls are 
up to the standard required. Als should also retain ultimate 
control over the outsourced data’. 


Fraudulent transactions 


2.2.6 Described here are some common sources of fraudulent 
transactions. As this is a complex and ever-changing 
area, Als need to be aware of the evolving typologies of 
fraud and monitor such developments on an ongoing 
basis. 


` These service providers may handle a variety of functions, including marketing agents, data 
processing operations for card issuers or a range of merchant services (such as billing, 
reporting, customer service, authorization and settlement) on behalf of merchant acquirers. 
As a result, a huge amount of credit card data (including customer information and transaction 
data) may be processed or stored in the systems of these service providers. 


ê Among other things, the outsourcing agreement with the service provider should allow for 
Supervisory inspection of the operations and controls of the service provider as they relate to 
the outsourced activity. 
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2.2./ 


2.2.8 


2.2.9 


Lost and stolen cards represent a major source of 
fraudulent transactions, which can be difficult to detect. 
Therefore, timely reporting of loss by cardholders is crucial 
for minimising potential losses on these transactions. 
Other types of fraud, such as counterfeit cards and internet 
fraud, are of growing concern. 


With enhanced technology, counterfeit cards can produce 
a very plausible imitation of a real card, and it is easy for a 
professional counterfeiter to copy the magnetic stripe 
information from one card on to another. Apart from 
duplicate card production, skimming is another means of 
counterfeiting credit cards. Skimming takes place during 
the course of a genuine transaction and involves copying 
the magnetic stripe details from a genuine payment card 
and transferring them to another card without the original 
cardholder s knowledge. 


Along with rapid technological developments and the 
increasing use of credit cards as a medium of payment for 
online purchases or fund transfers, fraudulent transactions 
via the internet are on the rise. Cardholders using internet 
banking services may be exposed to the risks of 
“phishing” / and “pharming” ° where they disclose 
confidential information regarding their accounts 
unknowingly to fraudsters through the internet. The 
difficulty of detecting such fraud lies in the fact that the 
transactions are all electronic and do not involve any face- 
to-face contact with the parties concerned. In other words, 
it is hard to Know whether the counterparty, or the website, 
is genuine. 


” Phishing attacks use both social engineering and technical subterfurge to steal consumers’ 
personal identity data and financial account credentials. Social-engineering schemes use 
“spoofed” emails to lead consumers to counterfeit websites designed to trick recipients into 
divulging financial data such as credit card numbers, account usernames and passwords etc. 
Hijacking brand names of banks, retailers and credit card companies, phishers often convince 
recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal 
credentials directly, often using Trojan Keylogger spyware. 


8 Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through 
DNS hijacking or poisoning. 
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2.2.10 Other types of fraudulent transactions may arise from the 
interception of cards in the mail, deceptive card 
applications, staff fraud, or forged mail orders”. 


2.2.11 In view of the significance of fraud control to credit card 
operations, Als should institute appropriate risk 
management measures to prevent and detect fraud (see 
subsection 5.4 for more details). 


2.3 Liquidity risk 


2.3.1 Both card issuing and merchant acquiring Als are exposed 
to liquidity risk, particularly so for Als whose credit card 
operations constitute a major part of their business. Card 
issuing Als are obliged to settle payments with merchant 
acquirers for transactions on behalf of their cardholders 
within a short period of time, regardless of when payments 
are received from cardholders (which might be spread 
across several months). Merchant acquiring Als may settle 
payments for credit card transactions with merchants 
before receiving payment from card issuers in respect of 
those transactions. 


2.3.2 Liquidity risk also arises for merchant acquiring Als where 
chargebacks or refunds to cardholders reach a level that 
cannot be covered by the merchants’ sales volume. 


2.3.3 Als should ensure that there is sufficient liquidity to meet 
their obligations arising from credit card transactions by 
establishing adequate liquidity management systems and 
controls (see LM-1 “Liquidity Risk Management” for 
general guidance). 


2.4 Legal and reputation risks 


2.4.1 Als are exposed to legal and reputation risks arising from 
non-compliance with laws, rules or regulations or breaches 
in the terms and conditions of the agreements with 
cardholders, merchants and credit card associations. 


2.4.2 Als should be wary of a whole host of events which, if 
incurred, can induce adverse publicity and legal action 
from disgruntled parties. Examples include: 


° Much less checking can be done on mail orders, as they normally require less information, 
such as a card number and expiry date. 
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e adoption of improper practices that lead to unfair 
treatment of credit card customers; 


e misconduct of debt collection agencies used by Als; 


e issue of credit cards indiscriminately to students (i.e. 
those without stable income or independent financial 
means); 


e perpetration of staff fraud resulting in unauthorized 
transactions or misuse of credit card information; and 


e theft of credit cards and customer information due to 
lax internal security controls or inadequate control 
over the security standards of third party service 
providers to which all or part of the credit card 
operations have been outsourced. 


All such incidents run the risk of damaging Als’ reputation 
and leading to potential claims for losses and 
compensation. 


2.4.3 An Aľ s reputation can also be seriously affected by any 
adverse publicity on its merchants or partners of affinity or 
co-branded programmes. 


2.4.4 Als should not preclude the possibility that credit cards 
may be misused for conducting money laundering or 
terrorist financing activities, especially when the use of 
credit cards for payments or remittances through the 
internet (which may be exposed to a higher risk of 
abuse'’) becomes more common. Als should watch out 
for any potential abuse of credit cards for such purposes. 


1 As an example, the provision of worldwide internet remittance services by some remittance 
companies through debiting remitters’ credit cards may pose a high money laundering and 
terrorist financing risk. In conjunction with some credit card associations these service 
providers can effect fund transfers to beneficiaries worldwide by debiting the remitters’ credit 
card accounts and issuing ATM cards to the designated beneficiaries for fund withdrawals. 
To apply for such services, remitters simply open an account with the service provider 
through the internet by providing information on their credit cards and the beneficiaries. 
These remittance transactions are susceptible to money laundering and terrorist financing 
because: 


(i) the remittance company provides non-face-to-face services and does not conduct any 
customer due diligence on the remitter or the designated beneficiary; 
(ii) the ATM cards are easily transferable, thus allowing for greater anonymity than the 
traditional use of supplementary credit cards; and 
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3. Board and senior management oversight 


3.1 Business strategies 


3.1.1 Senior management is expected to develop and review 
the business strategies of an Al’ s credit card business in 
accordance with the overall business objectives and risk 
tolerances approved by the Board. These strategies 
should reflect realistic goals based on reasonable data 
and assumptions. 


3.1.2 With the greater sharing of consumer credit data in Hong 
Kong, Als are given access to more information to 
facilitate credit decision making not only in the credit 
application process but also during ongoing credit 
reviews. This gives rise to the opportunity for card issuing 
Als to consider the feasibility of adopting tiered interest 
rates or risk-based pricing according to the 
creditworthiness of individual cardholders in their 
portfolios, although whether such pricing strategies will be 
adopted is ultimately a matter for Als to decide based on 
their own circumstances. 


3.1.3 Some Als may, for strategic reasons, have a tendency to 
target the sub-prime market in their credit card solicitation 
programmes in order to earn more income (e.g. through 
charging higher interest rates and fees under risk-based 
pricing) from those customers with a weakened credit 
history (e.g. habitually late payments) and a greater 
appetite for credit than other ordinary customers''. Sub- 
prime credits can be profitable, provided that the interest 
charged by Als is sufficient to cover higher loan loss rates 
and overhead costs related to underwriting, servicing, and 
collecting the credit. 


(iii) it is likely that most of these transactions will not be regulated (i.e. no competent 
authorities will be aware of them when the remittances take place in their jurisdictions). 


" The sub-prime programmes mentioned in para. 3.1.3 above refer to those that purposefully 
employ tailored marketing, underwriting and risk selection policies and criteria to solicit 
customers whose credit quality is generally weaker than other average customers (e.g. they 
may have overdue records exceeding 90 days and hence exhibit higher probabilities of default). 
some may eventually go into bankruptcy or require a charge-off. As a result, the pricing and 
terms offered to sub-prime borrowers often differ substantially from those offered to prime 
borrowers, and separate and distinctly different underwriting standards are adopted. 
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3.1.4 


Als should recognise that there are unique and significant 
risks inherent in sub-prime credit card lending. Those 
wishing to engage in such activity will have to determine if 
these risks are acceptable and controllable, given the 
organisation's financial condition, portfolio size, level of 
capital support and staff expertise. 


Als may also consider promoting other types of unsecured 
lending products, such as personal loans, revolving credits 
and overdrafts, so that customers have more choices of 
the form of borrowing that best suit their needs. 


Als planning to expand their credit card business in 
overseas markets (e.g. through the issue of credit cards by 
their overseas branches or subsidiaries) should have a 
good understanding of the markets they intend to operate 
in, including the operating and competitive environment, 
the legal framework and judicial systems, and the risk 
profile and behavioural characteristics of their targeted 
customers. 


To facilitate the formulation and review of business 
strategies, Als should develop a framework for assessing 
regularly the profitability and return on their credit card 
portfolios.'“ Where appropriate, Als should adjust their 
business strategy based on the results of such analysis. 


Risk management controls 


3.2.1 


3.2.2 


The Board and senior management are expected to 
ensure that an Al has established a comprehensive risk 
management process for identifying, monitoring, 
measuring and controlling the risks associated with its 
credit card business (see IC-1 “General Risk Management 
Controls” for guidance). 


Although the organisational structure of credit card 
operations may vary among Als, there should be clearly 
defined accountability and responsibility at every level and 
sufficient segregation of duties (see also IC-1 “General 
risk management controls” ) in the following functions: 


12 For example, such analysis considers all associated costs (including origination costs, 
administrative or servicing expenses, charge-offs and capital) and reviews performance against 
clearly set benchmarks such as target return, delinquency and charge-off levels. 
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e marketing and account solicitation; 


e application approval; 

e risk management; 

e fraud control; and 

e delinquency management. 


3.2.3 Als should establish policies and procedures for their 
credit card operations that are commensurate with the 
scale of such business. The policies and procedures 
should be documented in writing and approved by senior 
management or any committee with delegated authority. 


3.2.4 The policies and procedures for credit card operations 
should cover the following major areas: 


e Application approval — these should describe clearly 
the underwriting criteria for approving new 
cardholders and merchants, the mechanism for 
review of the criteria, the frequency of such review, the 
documentation requirements, the policy relating to 
setting of credit limits for cardholders and the authority 
and parameters for approving exceptions or 
overrides; 


e Credit risk management — these should set out the 
procedures for management of cardholders’ credit 
limits (such as the criteria for card upgrade, card 
renewal and increase in credit limit) and ongoing 
assessment of merchants’ financial and operational 
condition. The role and functions of a credit risk 
management unit and the tools for managing credit 
risk should be clearly described, including how the 
asset quality of a credit card portfolio is evaluated 
regularly, how merchant chargebacks are monitored 
and the types of corrective actions to be taken where 
concerns exist with particular cardholders or 
merchants; 


e Operational risk management — these should cover 
the procedures and controls in respect of physical 


security controls on credit cards, controls over 
authorization of credit card transactions, integrity of 
transaction data and timely processing of 
transactions, controls over customer data retention 
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and confidentiality, information technology controls, 
back-up and disaster recovery plans, managing 
outsourcing risk, and measures to prevent and detect 
fraud; and 


e Delinquency management — these should cover the 
classification of delinquent accounts, provisioning, 
charge-off, restructuring and collection actions. 


3.2.5 Senior management should review regular reports which 
detail management information on Als’ credit card 
operations, including the number of new cardholders and 
merchants, account attrition, portfolio composition, sales 
volume, credit quality, over-limits and overrides, and 
chargebacks and frauds. 


3.2.6 Regular audits performed on credit card operations should 
generally cover: 


e compliance with internal policies and procedures 
(such as credit underwriting and review, authorization, 
documentation, delinquency monitoring and collection 
procedures, fraud control, segregation of duties and 
access controls) and relevant regulatory rules and 
guidelines; and 


e use of scorecards and credit card related outsourcing 
activities, if applicable. 


Any weaknesses and irregularities identified should be 
reported to senior management and rectified promptly. 


3.2.7 Als which are engaged in sub-prime credit card lending 
should have in place systems and controls that typically 
involve enhanced performance monitoring, intensive 
collection activities and other loss mitigation strategies. 
Sub-prime accounts should be differentiated within the 
credit card portfolio, and sufficient capital and resources 
should be available to support such activity. 


4. Account solicitation and approval process 


4.1 Marketing programmes 


4.1.1 A well-documented proposal should be prepared for each 
major marketing programme. The proposal should, where 
applicable, include: 
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e the target market segment and forecasted customer 
response rate; 


e the basis of the marketing approach; 


e product pricing, profit projection, expected usage and 
delinquency and loss rates; 


e underwriting criteria; 

e documentation requirements; 

e the policy on credit limit assignment; and 

e requirements for operational and system support. 


4.1.2 If the marketing proposal involves any significant relaxation 
of existing product terms (e.g. an extended payment cycle 
or a reduction in the minimum payment required’”), there 
should be a detailed risk assessment and due 
consideration of related risk management implications. Als 
are encouraged to consider the need for setting a cap on 
the number of cards allocated to or the amount of the 
exposure to be incurred under such programmes. 


4.1.3 Procedures should be in place to ensure that the 
marketing proposals are commercially sound and 
operationally feasible. Particularly, these procedures 
should be able to establish that: 


e the profit projection is reasonable; 


e the underwriting criteria are prudent and appropriate 
risk control measures are in place; 


e the proposal complies with the relevant regulatory 
requirements and the Al’ s internal policies and limits; 
and 


e adequate system capacity is available to support 
implementation of the proposal. 


Marketing programmes that operate outside the pre-set 
procedures should be approved by senior management 


'S Als should guard against lowering minimum payment requirements and extending principal 
payment cycles to an extent that may result in negative amortisation of card receivable 
balances (i.e. outstanding balances continue to increase as minimum payments consistently 
fall short of covering all finance charges and fees assessed during a billing cycle). 
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and, where appropriate, be reviewed by the relevant 
departments before launching. 


Als should review the outcome of major marketing 
initiatives to ascertain whether these initiatives have 
achieved their objectives and whether there are any issues 
or lessons that should be taken into account in the planning 
and implementation of future programmes. 


Als often use “pre-approved”, “affinity” or “co-branded 
card” programmes to solicit new customers. This is 
acceptable as long as the offer of such programmes does 
not amount to liberal granting of credit cards to selected 
customers. In the case of “affinity” or “co-branded” 
programmes, Als should ensure that they have adequate 
control over the approval and acceptance of such 
accounts. 


Each application solicited from the above programmes 
should be thoroughly assessed against prudent 
underwriting criteria. To facilitate credit assessment, 
these customers should still be required to submit 
application information (see para. 4.2.1 below and 
footnote 14) along with their income proof or, where 
appropriate, “income surrogates” (see paras. 4.3.2 to 
4.3.4 below). 


For marketing programmes that target existing customers, 
Als may require less information from the applicants if 
certain information (e.g. static personal information) is 
already in their possession (see also para. 4.2.2 below). 


Application information 


4.2.1 


Als should collect sufficient information, either through 
application forms '* or other means (e.g. the credit 
reference agency'’), for the purpose of assessing the 
creditworthiness and financial position of credit card 
applicants. Such information generally include: 


e Personal particulars - e.g. name (including former or 
other name(s)), date and place of birth, Hong Kong 


These include application forms accessed or distributed through the internet. 


1 Als are encouraged to make full use of the credit reference information of individual applicants 
available from the credit reference agency in their credit assessment process. 
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identity card or passport number, nationality, marital 
status, educational background, residential address 
(and permanent address if different), residence type 
(mortgaged, owned or rented) and monthly rent or 
mortgage instalment amount; 


e Occupation details - e.g. name of present employer, 
office address, nature of business, present position, 
years of service with the present employer and 
monthly or annual income; and 


e Credit references - e.g. number of credit cards held, 
credit card limits granted, and information on other 
credit commitments or facilities (e.g. personal loan or 
overdraft). 


4.2.2 In the case of applicants who are existing customers of 
Als, there is scope for reducing the information required, 
such as the static personal information (i.e. name, date 
and place of birth, Hong Kong identity card or passport 
number) that is available in their database. Nevertheless, 
Als should consider the need for updating some other non- 
Static information (e.g. occupation or income particulars) 
that may have changed. 


4.2.3 Als should make known to the applicant what types of 
documents (see para. 4.3.2 below) should be submitted in 
his application. Als should not easily dispense with 
income proof requirements. In addition, there should be 
procedures in place to draw the applicant’ s attention to the 
major terms and conditions of the cardholder agreement. 
(see para. 2.3 of “Review of the Code of Banking Practice” 
issued by the HKMA in November 2001).'° 


4.2.4 Als should obtain relevant information (e.g. through the 
credit reference agency) to ascertain whether: 


e the applicant has owned any credit card that was 
cancelled due to default payment; 


e the applicant has any overdue payment exceeding, for 
example, 30 days, in respect of his indebtedness; 


'8 If an application is accepted by phone, Als should request the applicant to submit the required 
documents for verification. 


21 


HONG KONG MONETARY AUTHORITY 
r He ce al BE ja 


Supervisory Policy Manual 


CR-S-5 


4.3 





Credit Card Business 


4.2.5 


4.2.6 


e there is any bankruptcy order made against the 
applicant; and 


e the applicant is in the process of petitioning for 
bankruptcy. 


such information should be taken into account in making 
the credit decision. 


To protect Als’ interests, applicants should be required to 
make a declaration on the application form to certify the 
truth and completeness of the information submitted. Als 
may also wish to alert applicants that if they make a false 
statement in the application and subsequently default, they 
may commit an offence under section 71 of the Crimes 
Ordinance. 


Application forms (particularly the cardholder s declaration 
and the major terms and conditions of the cardholder 
agreement) should be properly reviewed by the internal 
compliance and legal unit or external lawyers to make sure 
that they comply with all relevant legal and regulatory 
requirements (e.g. Personal Data (Privacy) Ordinance) 
and do not contain any false information which may 
constitute misrepresentation to the applicants. 


Verification of documentation and credit checking 


4.3.1 


4.3.2 


Every application should be checked for the completeness 
of documentation and to screen out unqualified 
applications, e.g. under age. 


Valid documents for verification of the identity and 
creditworthiness of new customers!” should be obtained. 
Such documents include: 


e identity proof (e.g. copy of Hong Kong Identity Card or 
passport); 

e address proof; and 

e income proof (e.g. latest income tax demand note, 


latest payroll advice, bank statements showing the 
past three months’ salary). If the applicant is self- 


1 In the case of existing customers, Als may wish to update changes in their non-static 


information. 
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4.3.3 


4.3.4 


4.3.5 


4.3.6 


employed'*, unemployed, or retired, in which case 
income proof may not be available, appropriate 
alternative evidence or “income surrogates” (see 
paras. 4.3.3 and 4.3.4 below) should be obtained to 
support the application. 


Als may sometimes waive the requirement of income proof 
and accept alternative evidence to estimate the income of 
the applicants. This practice, if undertaken, requires that 
there are robust procedures for assessing and verifying 
such alternative evidence. While income proof is not the 
only consideration for a credit card application, Als should, 
where possible, dotain such information (and preferably 
information about expenditures such as instalment 
payments) to assess the applicant’ s repayment ability. 


Als may use income surrogates (e.g. fixed deposit 
receipts or main bank account statements for the last three 
months) to assess the financial strength of applicants who 
are unable to provide income proof, or to supplement 
income proof submitted by them. Certain income 
Surrogates, such as the credit card statement issued by 
other Als, home or car ownership (which may be subject to 
mortgages), credit card sales slips or subscription to 
mobile phone services, are however not reliable 
substitutes for income proof. 


Where income surrogates are used, Als may wish to grant 
a lower credit limit to the successful applicant initially, 
especially if there is no available record on his credit 
history (see para. 4.3.6 below). A normal limit may be 
granted when the applicant has established a satisfactory 
credit history. 


Checking of applicants against internal and external credit 
records should be performed. In particular, Als may obtain 
useful information from the credit reference agency on 
such matters as the credit exposures of the applicant, 
whether the applicant has lodged a petition for bankruptcy, 
or his past credit performance. 


18 Self-employed applicants may submit the Business Registration Certificate, the latest profit 
tax demand note and other deposit proof instead. 
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4.3.7 


4.3.8 


4.3.9 





Als should conduct proper customer due diligence on 
applicants, including the checking of details of applicants 
against a database of names and particulars of terrorist 
suspects which consolidates the various lists issued by the 
United Nations and other countries (e.g. US Executive 
Order) for the purpose of identifying cases relating to 
terrorist financing (see ML-1 “Prevention of Money 
Laundering”’’ for further details). 


Als should also check publicly available information or 
commercially available databases to establish whether an 
applicant is a politically exposed person (“PEP”)*°. The 
decision to approve the application of a PEP should be 
taken at a senior management level. 


Als that process credit card applications through mail 
should put in place sufficient safeguards to prevent the use 
of stolen information (e.g. theft of ID cards) for getting 
applications approved. The Code requires Als to bear the 
losses resulting from such applications unless the 
cardholder has acted fraudulently or with gross negligence. 


Underwriting criteria 


4.4.1 


Procedures should be in place to screen out applicants 
with unfavourable credit attributes. This is usually achieved 
by requiring an applicant to meet a set of underwriting 
criteria before approving the application. The attributes 
generally cover the following areas: 


e income level; 


e nature of employment, particularly in respect of job 
security and income stability“ ' ; 


'? This module is under development. For the time being, see Guideline 3.3 “Prevention of 
Money Laundering” issued on 21 December 2000 and the Supplement issued on 8 June 2004. 


a PEPs are defined as individuals being, or who have been, entrusted with prominent public 
functions, such as heads of state or of government, senior politicians, senior government, 
judicial or military officials, senior executives of public organisations and senior political party 
officials. The concern is that there is a possibility, especially in countries where corruption is 
widespread, that such PEPs may abuse their public powers for their own illicit enrichment 
through the receipt of bribes etc. 


“! To facilitate assessment, Als should identify occupations that carry higher credit risk. 


24 


HONG KONG MONETARY AUTHORITY 
T 3 ae Aa EY BE ja 


Supervisory Policy Manual 





CR-S-5 Credit Card Business 


e acceptable credit record and checking results (see 
para. 4.3.6 above); 


e asset requirement (especially for high risk customers 
or customers with no stable income source); 


e acceptable age range; and 


e permanent residence (in other words, temporary 
addresses such as hotel address or post office box 
number should not be accepted by Als). 


Underwriting criteria should not be relaxed imprudently 
because of competition or for the purpose of market 
penetration. 


4.4.2 Specific procedures should be established for handling 
applications from customers who do not have stable 
income or independent financial means. In particular, Als 
should set out clearly how the repayment ability of these 
applicants will be assessed and how the credit limit will be 
set. 


4.4.3 Where a credit scoring model is used to screen 
applications, Als should ensure that the credit scoring 
system (e.g. credit attributes and cut-off score ~~) is 
regularly reviewed and, if necessary, updated to ensure 
that it remains valid despite changes in the customer 
profile. See Annex A for a general description of the use 
of scoring systems for credit risk management purposes. 


4.4.44 The HKMA recognises that issuing credit cards is a 
commercial decision for Als. However, it is important that 
Als maintain prudent underwriting standards at all times so 
that their credit card portfolios can withstand the effect of 
economic downturns when undesirable trends in consumer 
lending (e.g. the edging up of delinquency and charge-off 
ratios and the rising trend in bankruptcies) are more likely 
to take place. 


A cut-off score is the minimum credit score determined by an Al’s management. Borrowers 
whose credit scores are not above the approved cut-off score do not meet the Al s minimum 
underwriting criteria. However, management may override a borrower s unacceptable credit 
score when other mitigating factors are present. Exceptions to the Al’ s credit scoring system 
should be properly documented. Als should consider whether they need to adjust their cut-off 
scores to reduce the incidence of bad debts. 
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4.5 Controls over approval process 


4.5.1 There should be guidelines and clear parameters for 
approval and monitoring of exceptional cases (i.e. 
applications which are approved with deviations from Als’ 
established underwriting criteria). Als should establish 
limitations to control the exceptional approvals that can be 
granted (e.g. in terms of a ratio of the number of approved 
applications). There should also be ongoing tracking of 
the level of exceptional approvals and the performance of 
those accounts. 


4.5.2 Als using a credit scoring system should similarly control 
the cases referred for manual review. If such cases have 
exceeded the prescribed level, the underlying reasons 
should be investigated. 


4.6 Credit limit assignment 


4.6.1 Credit limits should be decided on the basis of the credit 
profile of individual customers and by reference to the 
customer s monthly income or other relevant factors such 
as overall banking relationship, total asset balance or 
deposits held. Other considerations in assigning credit 
limits include the prevailing economic conditions and 
customers’ job stability and risk appetite. Keen 
competition should not be a justification for assigning 
higher credit limits. 


4.6.2 For Als using a credit scoring system, the factors 
mentioned in para. 4.6.1 are valid considerations to be 
incorporated into the system. 


4.6.3 There should be a maximum credit limit for each customer 
to control his total unsecured credit exposures. The limit 
may be set as a multiple of the customer s monthly income. 
For customers with multiple credit cards issued, a 
centralised credit limit or sub-limits for individual credit 
cards should be set. 


4.6.4 Any increase in existing credit limits should be premised 
upon the spending record and good repayment history of 
the cardholder. If the increase is initiated by the 
cardholder, Als should ensure that the information on the 
cardholder is adequate for evaluating his request. 


26 


HONG KONG MONETARY AUTHORITY 
r He ce al BE ja 


Supervisory Policy Manual 


CR-S-5 


4.7 


4.8 





Credit Card Business 


4.6.5 


4.6.6 


Over-limit tolerances can magnify the risk of credit card 
lending, especially for sub-prime accounts. Timely 
repayment of amounts that exceed established credit limits 
is therefore important. 


The criteria for credit limit assignment or increase should 
be analysed and documented before implementation. 


Card issuing controls 


4.7.1 


4.7.2 


4.7.3 


Als should have adequate controls in place over the 
embossing, safe-keeping and distribution of credit cards 
to cardholders. 


Als should set up an independent unit responsible for card 
embossing. Cards should only be embossed upon receipt 
of a proper authorization. Als should also establish 
security controls (e.g. dual access control) over the 
embossing area and maintain a register of issued, 
returned, spoiled and unused blank cards. Surprise audits 
should be performed in order to detect any unauthorized 
use of blank cards. 


Als should issue cards and PINs separately and take 
reasonable steps to satisfy themselves that these have 
been received by cardholders, whether they are personally 
collected by cardholders or delivered by mail or courier. 


Approval of new merchants 


4.8.1 


Merchant acquiring Als should establish a set of prudent 
underwriting criteria and procedures for approving new 
merchants which accept payments for the purchase of their 
goods and services by credit cards. As a minimum, the 
criteria for assessing the creditworthiness and reputation 
of new merchants should cover the following areas: 


e nature of business; 
e years in business; 


e size of operations (e.g. number of retail branches and 
employees); 


e financial strength and reputation (particularly for high 
risk merchants); 


e previous and projected sales volume; 
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4.8.2 


4.8.3 


4.8.4 


e daily statements from previous merchant acquirers, if 
any; and 


e existing business relationship with the Al concerned. 


Als should also establish criteria for identifying merchants 
that carry higher risk. Such merchants may include those 
involved in the provision of goods or services where orders 
are accepted without the cardholder being physically 
present, or where full or partial payment is accepted for 
goods and services delivered at some future dates (e.g. 
mail or telephone order operators, direct selling 
distributors or e-commerce merchants). Due to the 
special features of these merchants (e.g. they do not have 
physical retail outlets and most of their transactions are 
prepayment in nature), they should be subject to more 
stringent underwriting criteria. 


Based on the above criteria, Als should conduct a 
thorough assessment of the prospective merchants. This 
includes negative vetting with the credit card associations 
such as Visa and MasterCard. On-site inspection of the 
business premises of retail merchants (or browsing on the 
websites of ecommerce merchants) can be performed 
where appropriate to ensure the existence of their place of 
business. 


Als should only accept merchants whose overall financial 
position, business integrity and reputation are considered 
to be satisfactory. For those that fail to meet the selection 
criteria or whose nature of business is considered as high 
risk (e.g. e-commerce merchants), Als may consider 
taking any one or a combination of the following actions: 


e requiring them to provide additional collateral such as 
pledged deposits (e.g. equivalent to approximately 
one month’ s sales volume) or bank guarantees; 


e charging them a higher merchant discount rate to 
cover additional risk incurred; 


e deferring payments or retention of an agreed 
proportion of merchant sales turnover for a specified 
period; or 


e rejecting their applications. 
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Account and portfolio management 


5.1 


5.2 


Cardholder account management 


0.1.1 


9.1.2 


5.1.4 


The account management system of card issuing Als 
should be able to segment cardholders into different risk 
types (e.g. high, medium or low). For example, Als may 
differentiate cardholders according to their account 
behaviour (such as credit limit utilisation, frequency of cash 
advance, payment of minimum balance, timeliness of 
repayment and delinquency record) or behavioural score 
(see Annex A). 


Decisions such as increase in credit limit and card 
renewal should be based on a cardholder’ s updated credit 
risk profile and repayment history. 


For high risk cardholders (e.g. those experiencing 
repayment problems on their cards), there should be an 
effective mechanism to reduce the maximum credit limit 
granted in a timely manner, freeze the remaining available 
credit limit or block the cardholder’ s credit card from 
further transactions, as appropriate. Als should inform the 
cardholder of these actions as soon as practicable. 


Locally incorporated Als should have systems in place for 
measuring aggregate exposures to individual cardholders 
for the purposes of complying with §§ 81, 83 and 85 of the 
Banking Ordinance. 


Where Als offer more than one credit card to a cardholder, 
they should consider in totality the outstanding amount and 
performance of all his accounts to ensure that the total 
credit extended to the cardholder is not beyond his ability 
to repay. 


Als should also have sufficient management information 
systems to identify, measure, manage and control the risks 
associated with over-limit accounts. 


Merchant account management 


5.2.1 


Merchant acquiring Als should establish policies and 
procedures for ongoing monitoring of their merchant 
accounts. Regular review should be conducted to assess 
the operational (e.g. sales volume, service quality, 
chargebacks and fraud cases) and financial (e.g. account 
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2.2 


5.2.3 


5.2.4 


5.2.5 


5.2.6 


performance and profitability) condition of individual 
merchants. Depending on the level of sales turnover, 
merchant visits should be conducted to assess the nature 
of business and sales activity. 


Als should have adequate systems and controls in place 
for monitoring merchant sales volume. Apart from 
identifying those merchants who may be charged a higher 
discount rate because of unsatisfactory sales volume, this 
process can be an effective means b help identify any 
unusual or sudden jump in merchants’ sales volume or 
authorization requests, which may warrant investigations or 
implementation of preventive measures against any 
potential losses. 


To facilitate the monitoring process, Als should set a daily 
limit with individual merchants, taking account of their 
business nature and previous and projected sales volume. 
lf the merchant’ s daily sales volume exceeds the daily limit, 
Als may consider withholding funds to the merchant 
temporarily or conduct further investigation into the reason 
for the excess. Proper approval should be obtained 
before releasing the funds withheld. The limit should be 
reviewed regularly and adjusted to cater for seasonal 
factors and market conditions. 


Als should have systems in place to monitor trends of 
merchants chargebacks and capacity to repay 
chargebacks. They should take appropriate measures 
(e.g. requiring additional collateral and guarantees) where 
concerns exist with particular merchants. Als may 
consider withholding funds to merchants under the 
following situations: 


e excessive chargebacks; 


e suspected fraudulent activity pending internal 
investigation; and 


e irregular sales slips sent on a collection basis. 


The relationship with merchants with confirmed fraudulent 
activity should be terminated immediately. 


Als should ensure that merchants have exercised proper 
card acceptance and authorization procedures to avoid 
chargebacks and disputes. 
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Portfolio quality and analysis 


5.3.1 


5.3.2 


5.3.3 


5.3.4 


5.3.5 


5.3.6 


5.3.7 


The credit risk management unit should regularly provide 
sufficient information on the asset quality of the credit card 
portfolio for management review. This helpos management 
identify the level of risk and initiate prompt corrective 
actions if necessary. 


The credit risk management unit should regularly review 
and monitor the quality of the portfolio by segmenting the 
portfolio (e.g. by marketing programme, demographic 
distribution, affinity relationships, and vintage °?) and 
evaluating both historical and forecasted trends in 
profitability, delinquencies and charge-off ratios of each 
segment. 


Adequate management reports should be made available 
to the credit risk management unit for portfolio 
management purposes. Regular performance tracking 
reports should be generated for review covering the 
following aspects: 


e revenue and profitability; 

e attrition analysis; 

e credit limit utilisation (including over-limit accounts); 
e delinquency analysis; and 

e loan loss provisions and charge-offs. 


Als’ stress-testing programme should take into account the 
impact of adverse scenarios on their credit card portfolios 
(see IC-5 “Stress-testing” for details). 


The portfolio should be analysed to identify high risk 
categories of cardholders and the Al’ s exposure to them. 


Yardsticks signalling further deterioration of portfolio 
quality and the need for corrective actions should be 
established and documented. 


Prompt corrective actions should be considered in dealing 
with deterioration in the quality of the credit card portfolio. 
Such actions could include adjusting the approval scores, 


3 This refers to an analysis of the account performance of homogeneous loans booked at a 
similar time using the same credit and pricing criteria. 
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tightening the policies on initial assignment of credit limit 
and subsequent review of credit limit, increasing collection 
Capacity, making early reminder calls on overdue accounts 
and developing restructuring programmes (see subsection 
5.6 below). 


5.4 Fraud control 


5.4.1 Accurate and timely reporting on fraud is critical in 
controlling fraud losses. Als should therefore institute 
appropriate systems and controls to ensure that fraudulent 
activities are recognised in a timely manner (e.g. through 
review of fraud monitoring reports capturing out-of-pattern 
purchases or suspicious purchasing patterns**), and the 
affected accounts are appropriately blocked to prevent 
further transactions being conducted through these 
accounts. Suspected fraud cases should be investigated 
and properly documented. 


5.4.2 Als should maintain a dedicated fraud management unit 
for the above purposes, and to take necessary actions 
whenever they become aware, or are notified by 
cardholders, of fraudulent or potentially fraudulent activity 
(e.g. for lost and stolen cards). Such actions include: 


e preparing fraud reports, and analysing the trend and 
pattern of fraudulent activities; 


e notifying relevant cardholders (where appropriate) of 
suspected fraud and blocking the relevant accounts 
from further transactions; and 


e investigating fraud accounts, preparing fraud 
notifications to credit card associations and reporting 
fraud cases to relevant authorities for investigation 
and prosecution. 


5.4.3 Inthe treatment of unauthorised transactions reported by 
cardholders and in determining their liability for loss arising 
from such transactions, Als should have regard to the 


*“ Out-of-pattern-purchase reports identify suspicious transactions that do not fit an individual 
cardholder’ s established purchasing pattern whereas suspicious-purchasing-pattern eports 
identify certain types of purchases, such as electronics or jewellery, that may correlate with 
fraudulent activity. 
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provisions set out in Clauses 28.3, 30.3 and 30.4 of the 
Code. 


5.4.4 Als should notify the HKMA if they are aware of any 
incidents of credit card misuse or fraud affecting a 
substantial number of customers or involving significant 
sums of money. 


5.4.5 Als should review their average fraud losses to determine 
if staff can identify fraudulent activities in a timely manner. 
Relevant employees should receive proper training on 
fraud control and the handling of fraud cases relating to 
credit cards. 


5.4.6 The risk of credit card misuse may also be reduced by 
establishing adequate internal controls and operating 
procedures in the credit card department, including: 


e controls over authorization of credit card transactions, 
which could serve as a first line of defence against 
fraud; 


e measures to prevent application fraud (e.g. through 
thorough checks on applicants, including name and 
address verification, and restricted access to and 
controls over alteration of customer information); 


e procedures for issuing cards to prevent employees or 
others from intercepting them before delivery to the 
cardholders; 


e procedures to prevent merchants from obtaining 
control of cards; 


e procedures for handling returned cards, statements, 
PINs and lost and stolen cards to prevent them from 
fraudulent use; and 


e controls over cardholder payments and account 
balances, and chargeback administration. 


5.4.7 Als should closely monitor the card acceptance patterns 
and activities of merchants that they have signed up (in 
particular those categorised as high risk), including the 
conduct of on-site inspections where necessary. They 
should watch out for irregularities, which may include: 


e excessive number of disputed or split charges; 


e unusual and significant fluctuations in sales volume; 
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e frequent excesses over daily limits on sales volume; 


e repeated authorization of transactions incurred by the 
same card at one time; or 


e ahistory of accepting transactions from credit cards 
which were later found to be stolen, lost or forged. 


5.4.8 Als should conduct investigations and take other 
appropriate measures to deal with merchants suspected of 
fraudulent or irregular activities (see also paras. 5.2.4 and 
5.2.5 above). 


5.5 Delinquency management 


5.5.1 An independent collection unit should be set up for 
managing delinquent accounts and collection actions. 


5.9.2 There should be written policies on management of 
delinquent accounts covering the classification of problem 
accounts, provisioning and charge-off (See section 6 
below), controls on rescheduled accounts and collection 
actions. 


5.5.3 There should be reports to support management of 
delinquent accounts. Regular tracking reports on the 
effectiveness of collection actions (e.g. on the recovery 
rate) should be reviewed by the collection unit. 


5.5.4 The actual delinquency and charge-off ratios for different 
target customer segments within the credit card portfolio 
and for the portfolio as a whole should be regularly 
monitored and compared against the projected ratios. 
Any significant deviations from the projected trends and 
performance should be analysed and explained. 


5.5.5 Guidelines and procedures should be established for the 
appointment of external debt collection agencies for debt 
recovery. Adequate controls should be in place to ensure 
that the management of such agencies is in line with the 
provisions of the Code. 


5.0.6 If Als become aware of any suspicious cases of fraudulent 
bankruptcies, they should report them to the relevant 
authorities for investigation. These include cases where 
customers have obtained or attempted to obtain credit 
after filing of petitions for bankruptcy. 
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9.0./ 


Als should review the need for increased resources to 
cope with any rising trend of bankruptcies. They should 
also consider means to deal with potential bankruptcies 
(e.g. initiation of debt relief plans and debt counselling). In 
predicting bankruptcies, Als should regularly evaluate the 
effectiveness of their scoring systems and other forms of 
credit analysis. 


Restructuring and debt relief plans 


5.6.1 


5.6.2 


5.6.3 


5.6.4 


It is generaly in an Als best interests to consider 
restructuring the repayment terms or work out a debt relief 
plan with cardholders who are unable to repay their 
outstanding debts in accordance with the original terms but 
who show the willingness and ability to repay if the terms 
are modified, rather than putting them into bankruptcy 
hastily. In fact, some of these cardholders can be nursed 
back to health and may be able to repay their debts if 
some concessions are granted (e.g. forgiving a portion of 
the amount owed or lowering the original interest rate). 
For guidance on the management of problem credits, see 
CR-G-10 “Problem Credit Management” and the “Hong 
Kong Approach to Consumer Debt Difficulties” jointly 
issued by the Hong Kong Association of Banks, the DTC 
Association, the Finance House Association and the 
HKSAR Licensed Money Lenders Association. 


In designing a restructuring or debt relief plan, Als should 
aim at helping the cardholders to extinguish their 
outstanding debts. Such plans should, therefore, be 
designed to maximise recovery of principal, rather than 
maximising income recognition or deferring losses. For 
example, lowering the minimum payment requirement may 
not be useful in helping the cardholders to repay their 
debts if normal fees and finance charges are continued to 
be levied on the outstanding balance. 


The repayment period of debt relief plans should generally 
be within 60 months. Any exception to this time frame 
should be well justified and properly documented. 


Als should state clearly in their accounting policies whether 
credit card accounts under a restructuring or debt relief 
plan will continue to be regarded as credit card 
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receivables or will be reclassified as other types of 
personal lending. 


6. Provisioning and charge-off 


6.1 General 


6.1.1 


6.1.2 


This subsection highlights the loan classification, 
provisioning and charge-off practices commonly adopted 
by Als for their credit card portfolios. The HKMA does not 
intend to prescribe a standardised approach for these 
practices, as this may not suit the circumstances of every 
Al. 


It is envisaged that the adoption of new Hong Kong 
Accounting Standards (“HKAS”) in 2005 and the 
implementation of the revised capital adequacy standards 
in 2007 wil bring about further changes in the way Als 
grade the credit quality of their retail assets and estimate 
the potential losses on these assets. The HKMA will 
monitor such industry developments and consider 
providing more specific guidance on these issues as and 
when necessary. 


6.2 Overdue period 


6.2.1 


6.2.2 


6.2.3 


Credit card receivables are generally monitored 
collectively on a portfolio basis and classified according to 
the length of the overdue period. 


The practice of determining the overdue period for credit 
card receivables varies among Als. The overdue period 
may be computed starting from: 


e the first statement date; 
e payment due date shown in the first statement; or 
e the second statement date. 


However it is measured, it should be applied consistently 
and stated explicitly in an Al’ s policy. 


In determining whether an account is overdue, some Als 
may allow a grace period for delayed payments due to 
technical factors such as postal delay or simple oversight. 
The grace period normally ranges from one day to a few 
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days and if the minimum payment is settled within the 
grace period, the account will not be regarded as overdue. 


6.3 Loan classification and provisioning 


6.3.1 Every Al should ensure that its loan classification and 
provisioning policies can truly reflect the asset quality of its 
credit card portfolio and provide adequate provisions to 
absorb potential losses that may arise from the portfolio. 


6.3.2 As the quality of a credit card portfolio may be best 
indicated by the repayment performance of individual 
cardholders, the HKMA considers it acceptable for Als to 
use the overdue period® as a predominant factor in 
classifying their credit card receivables. The following are 
some commonly adopted criteria for classifying such 
assets: 


e Special mention - accounts overdue for more than 30 
days to 90 days; 


e Substandard - accounts overdue for more than 90 
days to 120 days; 


e Doubtful - accounts overdue for more than 120 days 
to 180 days; and 


e Loss - accounts overdue for more than 180 days. 


6.3.3 Following the adoption of HKAS 39, the existing approach 
of maintaining specific and general provisions has been 
replaced by that for specific and collective provisions~’. 
As a result, Als will need to ensure that the approach they 


© A common practice among Als is to compute the overdue period using the payment due date 
shown in the first statement. Als applying a different basis in the computation of the overdue 
period should take this into account in adopting the classification criteria set out in para. 6.3.2 
above. 


“° For the purpose of this module, 


(i) “specific provisions” means an allowance for impairment loss of financial assets that are 
individually assessed for impairment in accordance with HKAS 39, and provisions made in 
accordance with HKAS 37; and 


(ii) “collective provisions” means an allowance for impairment loss of financial assets that are 
collectively assessed for impairment in accordance with HKAS 39, and provisions made in 
accordance with HKAS 37. 


In addition, Als may, in some circumstances, be required to hold a regulatory reserve for 
general banking risk. 
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6.3.4 


6.3.5 


6.3.6 


use for arriving at these provisions for credit card 
receivables meets the accounting requirements. 


Als are encouraged to develop appropriate models (e.g. 
historical experience-based loss rate models adjusted to 
reflect current conditions, migration analysis or various 
other statistical methodologies) to estimate the amount of 
expected losses for the credit card portfolios, which may 
serve the purpose of a collective impairment assessment. 


One of the models commonly used by international banks 
is the roll-rate (or net flow rate) methodology which 
analyses the migration of accounts from one billing cycle to 
the next. Roll-rate is the percentage of balances, or 
accounts, that move from one delinquency stage to the 
next. In terms of the credit card portfolio, his model is 
based on historical loss experience, and projects the future 
contractual losses (net of recoveries) that are embedded 
within the portfolio by taking the roll-rate for each time 
band, including that for “non-delinquent” accounts, and 
multiplying it by the net contractual loss for that time band. 


The roll-rate model can be adjusted to: 


e reflect the effects of current economic conditions that 
did not affect the period on which the historical loss 
experience is based and other factors such as the 
effectiveness of loan collection activities, recovery 
and write-offs; and 


e remove the effects of conditions in the historical 
period that do not exist currently. 


Subject to availability, a minimum of three years 
(preferably five years or more) of data should be used for 
the measurement of historical loss rates. Factors affecting 
economic conditions can be, for example, GDP, interest 
rate, unemployment rate and bankruptcy legislation. 
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6.3.7 Based on collection experience, when a portfolio’ s history 
reflects high losses and low recoveries, more conservative 
standards are appropriate and necessary. For example, 
Als should fully recognise incremental losses that may be 
inherent in over-limit portfolio segments and restructuring 
plans (in particular those with little progress in reducing the 
principal owed). 





6.4 Charge-off 


6.4.1 Als should set out clearly in their policies and procedures 
the criteria (i.e. the charge-off triggers used, such as 
bankruptcy or the overdue period) and the method (manual 
or automatic) for making charge-offs. An automatic 
charge-off mechanism can reduce manual intervention. 


6.4.2 As reflected from industry practices, most Als perform their 
charge-off exercise on a monthly basis and charge off their 
credit card accounts when: 


e the accounts have been overdue for more than 180 
days?” : 


e abankruptcy petition is filed against the cardholder or 
a bankruptcy order is issued; 


e a portion of debt was forgiven in a settlement 
arrangement’; or 


e aloss due to fraud or other reasons is discovered and 
determined. 


Als may be required to provide justifications if their 
practices are less prudent than the above. 


6.4.3 Als should keep memorandum records of charged-oft 
accounts for the amounts still formally owed by 
cardholders. 


? It is noted that some Als adopt more stringent criteria by setting the charge-off trigger at 150 
days or even 120 days overdue. 


3 Borrowers with financial difficulties may negotiate settlement agreements with Als. In a 
settlement arrangement, the Al forgives a portion of the debt in exchange for the borrower’ s 
promise to repay the remaining balance either in a lump-sum payment or by amortising the 
balance over several months. 
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Annex A: Scoring systems 


A1. Types of scoring systems 


A1.1 Scoring systems and scorecards are tools used to predict the 
credit behaviour and repayment risk of individual customers 
based on application data and data obtained from the credit 
reference agency through credit checking. They evaluate the 
credit quality of a borrower by assigning statistically developed 
scores to defined credit attributes. 


A1.2 There are generally two types of scorecards: credit scorecards 
and behavioural scorecards. Credit scorecards are used in new 
account applications to assess the creditworthiness of applicants. 
Behavioural scorecards assess the quality of a customer through 
studying his account performance and credit behaviour such as 
cash advance, repayment performance, expenditure pattern and 
credit limit utilisation over time. Behavioural scorecards are 
usually applied in the review process, individual account 
management, collection or fraud detection. 


A2. Development of scoring systems 


A2.1 A successful scoring system provides a standardised way of 
measuring the inherent risk of a borrower. An important measure 
of a scoring system is its definition of risk and the care with which 
explanatory variables are defined, data are collected, and the 
system is tested. The standardised risk measurement should be 
based on historical data, measure the risk of default or loss and 
produce consistent results across time for a wide range of 
borrowers. Further investigation should be made on borrowers 
who do not meet the scoring criteria. 


A2.2 There should be a proper management approval process for the 
rollout of new scorecards. Such a process should include 
selection of data samples, testing of the model and approval 
hierarchy for the rollout. 


A2.3 Scorecards should be developed by the credit risk management 
unit and, if necessary, in conjunction with an external vendor with 
relevant expertise in statistical modelling. External vendors 
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usually build scorecards based upon specific information and 
parameters provided by an Al’ s management’. 


A2.4 To achieve better predictability of a scoring model, the 
development sample should preferably be selected from an Al's 
database containing customers who applied for credit within a 
reasonably recent period of time, say, two years. 


A2.5 Scorecards should be validated by appropriate testing on bad 
rate (i.e. the percentage of approved accounts that became 
delinquent), and user acceptance before formal implementation. 


A2.6 For application scoring models, the cut-off score should reflect the 
underwriting standards and risk appetite of Als. There should be 
proper controls on who may decide and approve the level of the 
cut-off score, and the circumstances under which the cut-off score 
may be revised. Reasons and justifications for setting or 
changing the cut-off scores should be properly documented. 


A3. Monitoring of scorecard performance 


A3.1 The credit risk management unit should regularly monitor the 
performance of the scorecards by reviewing management reports 
covering: 


e population stability - a report comparing the current 
application population and the population on which the scoring 
system was developed and measuring whether there are any 
material changes in the score distribution over time; 


e characteristic analysis - an analysis measuring changes in 
applicants’ scores on individual credit attributes over time. 
This process is to help identify whether there is any shift in the 
population (which may in turn manifest itself in a change in the 
population stability index). The overall predictive power of the 
score in distinguishing good credits from bad credits should 
also be reviewed; 


e approval and rejection rates; 
e high and low side override rates”; and 


” Data used to develop the scorecard can come from three main sources: 
e an Al s previous good accounts, bad accounts and rejected applications; 
e pooled or purchased data whose features closely resemble applicants which the Al targets; 
and 
e expert intelligence (i.e. the logic and evaluation processes used by successful credit 
officers). 
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e delinquency vintage analysis - an analysis of the distribution of 
delinquency ageing by the time of account inception. 


A3.2 Validation of scorecards should be done regularly as needed to 
keep them statistically sound. The predictive ability of the 
scorecards should also be periodically evaluated by using 
Statistical principles and methodologies. 


A3.3 Proper controls for initiating the redevelopment of scorecards 
should be established specifying the criteria for initiating the 
redevelopment, and who may initiate and approve the 
redevelopment. 





% An override is a decision to accept or reject an applicant when the scoring system says 
otherwise. A high side override means that an Al rejects an application which the scoring 
system would approve while a low side override means that an Al approves an application 
which the scoring system would reject. 
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